Are you getting ready for the upcoming RSA Conference, the world’s leading information security conference and exposition? The event is quickly approaching, taking place April 24-27, 2023 at the Moscone Center in San Francisco. This year’s theme: Stronger Together. In the cybersecurity industry, no one goes it alone. Instead, we build on each other’s diverse knowledge to create the next breakthrough—exchanging ideas, sharing our success stories, and bravely examining our failures.
Ahead of the show, VMblog received an exclusive interview with Mike Nichols, Vice President of Security Product at Elastic, a leading platform for search-powered solutions, with solutions in Enterprise Search, Observability, and Security.
VMblog: To kick things off, give VMblog readers a quick overview of the company.
Mike Nichols: Elastic is the leading platform for search-powered solutions dedicated to helping organizations, their employees, and their customers by providing solutions in Enterprise Search, Observability, and Security.
Elastic Security helps users unify prevention, detection, and response to combat cyber threats at scale. This is important because SOC teams manage dozens of fragmented security toolsets, which can reduce the effectiveness of an organization’s threat defense. With Elastic Security teams can operationalize multiple security use cases, including SIEM, XDR, cloud security, and endpoint security, enabling them to minimize risk and protect their organization’s from damage and loss.
VMblog: Where/how can attendees find you at the show? Do you have a theme? How many folks are you sending? How many times have you sponsored the RSA Conference?
Nichols:
- Booth: #5879
- Speaking Session: How XDR is driving the modernization of security operations
- Session Abstract: Establishing effective security operations requires carefully considering several factors. Teams need to account for endpoints and servers to containers, Kubernetes, and multi-cloud environments. Embracing Extended Detection & Response (XDR) can help drive modernization. Join Elastic Security Product VP, Mike Nichols, and Elastic customer, Merium Khalid, Sr. SOC Manager, Barracuda to learn how teams are evolving with Elastic Security.
- Date: Wednesday, April 26
- Location: North Expo Hall Briefing Center
VMblog: What made you sponsor RSA this year? Is this a must sponsor event for your company?
Nichols: Elastic began exhibiting at RSA in 2019 following its acquisition of Endgame – an RSA sponsor since 2008. We consider the event a great opportunity to meet customers, share the latest innovations happening at Elastic, and exchange security intelligence with industry experts.
Elastic and the RSA conference share a common mission in the security industry – to unify the community and our diverse knowledge sets to spark the next breakthrough in cybersecurity. To deliver on this mission, Elastic gives customers complete visibility across their entire enterprise environment in a single, unified platform with capabilities in SIEM, XDR, cloud security, and endpoint security.
In our mission to democratize security, Elastic Security built our open security platform on Elasticsearch to help everyone eliminate data silos, automate prevention, detection, and response, and streamline security investigations by leveraging advanced analytics with years of data from across an organization’s entire attack surface.
VMblog: What is your message to RSA attendees coming out to the show this year?
Nichols: Visibility remains a key challenge for most organizations, and this has only been heightened with the rapid expansion to the cloud. No one wants to say, “I don’t know,” when the next SolarWinds attack happens and you are asked if your organization was affected. Prioritizing visibility both in breadth of systems covered and depth or length of time actionable, is key to a modern security operations center. And there is no shortage of new and exciting innovations coming out that rely on historical data to tailor for your organization, like generative AI.
Many organizations still have a fragmented approach to security, requiring practitioners to pivot between multiple tools and dashboards to monitor endpoints, servers, containers, and cloud environments. Having unified visibility across all environments is the only way to identify, analyze, and secure cyber assets. Our platform centralizes the visibility of all your data through a single, unified product to improvise attack surface visibility, reduce complexity and accelerate MTTR.
VMblog: What market needs or problems are you addressing in the security space?
Nichols: Between sophisticated adversaries, limited budgets, and mounting pressure from security-aware executive management, security practitioners are fighting on an uneven playing field. In a volatile environment like this, visibility and access are key to overcoming these challenges. This starts with eliminating data silos within an organization so that teams can easily gain crucial insights and take immediate action.
Elastic Security helps all organizations achieve this by enabling teams to ingest unlimited amounts of information and data, normalizing it in a uniform manner, and analyzing it in just a few seconds to identify lurking threats and expose newly discovered exploits. From there, practitioners are able to prevent, detect, investigate, and respond to complex threats by unifying the capabilities of SIEM, endpoint security, XDR and cloud security from a single pane of glass.
VMblog: What are some of the key takeaways of your solution that RSA conference goers should be aware of? And what sets you apart from the competition?
Nichols: Elastic Security provides users with a truly unified experience on a single platform. We offer the only unified security solution that blends SIEM, endpoint, XDR and cloud security capabilities – rooted in data management and analytics – that enables customers to protect, investigate and respond to threats across their entire infrastructure.
There are an endless number of observability and security tools on the market, but what makes Elastic unique is our ability to ingest and correlate any type of data. This granular insight across cloud, infrastructure, application, and security data gives customers a big-picture view of their digital environment, enabling them to correlate different datasets with context, and ultimately translate that context into insights and action.
VMblog: Is your company launching anything new at the show? Can you give us a sneak peek?
Nichols: We recently expanded the capabilities of our Elastic Security solution to include Cloud Native Application Protection, which is a combination of Cloud Security Posture Management (CPSM), container workload protection, and cloud vulnerability management, and cloud workload protection. At the show we’ll be highlighting our CNAP capabilities across the Amazon ecosystem.
A recent research report from Elastic Security Labs, our dedicated security intelligence and analytics team, discovered that nearly 1 in 3 attacks in the cloud leverage credential access, indicating that users often overestimate the security of their cloud environments and fail to configure and protect them adequately.
With these updates, organizations can now streamline their cloud security operations by establishing real-time, unified visibility across their environments in a single interface to quickly identify and stop security threats at scale. This unified visibility helps alleviate sophisticated security threats that thrive in fragmented cloud environments.
We’re excited for the ongoing expansion of our cloud security capabilities as we aim to help modernize and empower organizations to better defend themselves within the cloud.
VMblog: What will you be showing off at the show this year?
Nichols: In addition to the new cloud security features we will be demonstrating at the conference, we will be showcasing some exciting research and thought leadership from the Elastic Security Labs team and our Global Threat Report. Visitors to Elastic booth #5879 can get one-on-one time with our threat researchers analyzing emerging threats like SIESTAGRAPH and NAPLISTENER, and hear nearly 20 talks from security engineers.
We will also be previewing some impressive new AI and ML capabilities that are coming soon to Elastic Security that will provide cyber defenders of any experience level with a precision-guided response to prevention, detection, and remediation using natural language. But you will have to come by our booth to learn more!
VMblog: What are some top priorities for security leaders at RSA to consider this year?
Nichols: The top priority I hear most often from security leaders is securing their cloud environments, usually starting with visibility into this architecture.
While the breadth of cloud environments can offer organizations choice and flexibility, it also means IT leaders need to re-evaluate their security practices and consider how they may need to be adapted.
The saying “you can’t secure what you can’t see” is especially true in hybrid cloud architectures. Mixing public and private clouds or infrastructure can increase complexity and heighten an organization’s risk, making visibility and control paramount to securing a distributed system.
IT leaders need to consider the efficiency of their people resources and skills usage. In a hybrid cloud environment, security teams might need to learn the security functions of 2+ cloud services. In addition to avoiding manual monitoring for security and compliance by automating everything possible, finding a way to extrapolate the security configuration where a team only needs to learn one tool can help tremendously.
Organizations also need to consider the security of their software supply chain. That starts with having confidence in the software providers they work with – from secure distribution of the software to regularly updating with fixes for critical security vulnerabilities.
Closing those security gaps requires proper configuration of cloud environments to guard against social engineering assaults like phishing or baiting, or leaving an open, vulnerable environment on the Internet that hasn’t been properly secured. With cloud environments, as with any other deployment, if you do not maintain basic security hygiene or fully understand your environment, assets, or data flows, ransomware threats remain prevalent because the way data is accessed is the same.
VMblog: What are some of the security best practices you would deem critical?
Nichols: Security strategies need to evolve in two distinct ways:
First, by recognizing that people are your first line of defense. Certain factors like remote work environments have led to people connecting to and interacting with technology more than ever before-but this doesn’t necessarily make them more security-aware. A big security priority for organizations is to help their employees reframe how to operate in a digital world so that no individual becomes a single point of failure. Security teams need to increase general awareness across their organizations by helping people recognize how threat actors behave and how to avoid falling prey to social engineering threats.
Second, organizations need to get better at basic security hygiene. Too often, an organization’s environment is compromised by something as simple as a weak password or failure to update default configurations. Prioritizing security fundamentals – identity and access management, patching, threat modeling, password awareness, and multi-factor authentication – and embedding security reminders, alerts and training into day-to-day work activities are simple ways for security teams to prevent and protect against potential threats.
VMblog: The keynote stage will be talking about major themes theme’s this year. But what trends is your company seeing that we should be aware of in 2023 and beyond?
Nichols: The cybersecurity resource and skills gap is real and continues to be a major theme across the industry. The holy grail vendors have been chasing is to democratize security for all by demystifying the secretive and specialized world of security analytics so any user familiar with the business can triage and remediate attacks.
When Microsoft recently announced Copilot, the dream of making any user a cyber analyst became a step closer to reality. And they are not the only ones in the game of generative AI applied to specific domains, with Google Bard and others hot on their heels.
I expect “generative AI” to be the buzzword of the year at RSA, since AI models are evolving faster than we ever thought possible, and there are countless applications in the cybersecurity domain that will continue to (positively and negatively) disrupt the lives of security analysts everywhere.
VMblog: Does your company have any speaking slots at RSA? If so, can you tell us more about those sessions so people can get them on their schedules?
Nichols: I will be co-presenting with one of our customers from Barracuda on April 26 at 1:20pm PT:
How XDR is driving the modernization of security operations
Establishing effective security operations requires careful consideration. Teams need to account for endpoints, servers, containers, Kubernetes and multi-cloud environments. Embracing Extended Detection & Response (XDR) can help drive modernization.
Presenters: Mike Nichols, Vice President, Elastic Security Product, and Merium Khalid, Sr. SOC Manager, Barracuda
VMblog: Is your company giving away any interesting giveaways at your booth?
Nichols: All attendees are invited to stop by the booth for stickers, pins, socks, koozies, and more. We’ll also be giving away a JBL Bluetooth Speaker after each of our in-booth lightning talks – so attendees have 18 chances to win!
VMblog: As a show sponsor, do you have any tips for attendees to better prepare or handle the conference?
Nichols: Take advantage of all the resources RSA has to offer. Before attending the conference, explore the list of attendees, research the companies that will be on-site, and get acquainted with the conference agenda to get a solid grasp on the people that you’ll be interacting with and the conversations you’ll be participating in. Take that knowledge with you to the conference so you can spend your time effectively networking, exploring booths and speaker sessions that interest you, and further maximizing the meaningful takeaways and connections you’ll have when the conference is over.
##
